Abnormal data detection method based on improved differential privacy and clustering algorithm optimization

Abstract

The invention discloses an abnormal data detection method based on improved differential privacy and clustering algorithm optimization, and the method comprises the following steps: S1, obtaining a multi-dimensional to-be-processed data set, and carrying out the standardization processing of each parameter of a data point; s2, calculating Euclidean distance between data points based on an OPTICS clustering algorithm, adding noise to distance information by using a differential privacy algorithm, and optimizing privacy budget parameters in combination with an alpha-beta pruning algorithm; s3, core objects are judged, a core object set is constructed, and data points connected in density are classified into preliminary clustering clusters through a density analysis algorithm; s4, redistributing sparse data points in combination with a recommendation domain mechanism, and classifying the sparse points into the most adjacent high-density clustering cluster; and S5, carrying out classification by using an improved random forest algorithm, and balancing the problem of non-uniform data distribution through a weighted sampling mechanism. Through the differential privacy protection mechanism, the clustering optimization algorithm and the improved random forest classification model, efficient and accurate abnormal data detection giving consideration to privacy protection is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of data mining and analysis, and in particular to an abnormal data detection method based on improved differential privacy and clustering algorithm optimization. Background Art

[0002] With the advent of the big data era, various information data have exploded and involve all aspects of life. These data contain rich information and bring huge utilization value to enterprises or related institutions. In order to mine more valuable information and obtain the rules hidden in the data, it is necessary to use a variety of methods to process the data. Among them, clustering methods are widely used in the data mining process. Data is divided and abnormal data is filtered out according to different characteristics of data objects. However, in the use of traditional clustering algorithms, some parameters usually need to be input, which will have a certain impact on the results. At the same time, there is also a risk of data privacy leakage in the process of data clustering. Therefore, it is very important to strengthen data clustering to detect abnormal data while protecting data privacy information.

[0003] Cluster analysis is a statistical analysis method for studying data classification problems and an important data mining method. Unlabeled data can be divided into several subsets to form clusters of different categories, and then detect abnormal data. Among them, the k-means clustering algorithm is widely used. Subsequently, in response to the shortcomings of k-means, algorithms such as k-means++ and k-medians were proposed. Among them, the DBSCAN algorithm introduces the idea of ​​density-based clustering. Unlike the traditional hierarchical clustering and partition clustering convex clustering clusters, this method divides areas with sufficient density into clusters and finds clusters of arbitrary shapes in a noisy spatial database. It defines clusters as the largest set of points connected by density. It has the advantages of not needing to input the number of clusters to be divided, the shape of the clusters is not biased, and it is insensitive to noise data. However, the DBSCAN algorithm is easily affected by parameters. When their values ​​change, the clustering results may change significantly. On this basis, the OPTICS clustering algorithm is used. It is a density-based clustering algorithm improved on the basis of the DBSCAN algorithm and has low sensitivity to parameters. For the data clusters obtained by the final clustering, the random forest method is used for classification prediction to further improve the accuracy of the final prediction results.

[0004] The technologies related to privacy protection have attracted much attention. The technologies related to data privacy protection can be roughly divided into three categories, namely, data anonymization technologies, data encryption technologies, and technologies based on differential privacy protection. Differential privacy protection was proposed by Dwork in 2008. It achieves privacy protection by adding noise to the required data to prevent privacy leakage caused by a slight change in the data source. When clustering is used for abnormal data detection, the use of differential privacy methods can effectively prevent data privacy leakage. However, in the process of using differential privacy, the noise added will also affect the original data information. On the basis of the existing differential privacy technology, the alpha-beta pruning algorithm is used to obtain a suitable evaluation function to balance the privacy and practicality of the data. It can strengthen the use of the original data information on the basis of protecting data privacy and improve the detection effect of abnormal data.

[0005] Currently, the introduction of differential privacy protection technology in cluster analysis has become a hot topic of research. Existing technologies provide the use of differential privacy in the k-means clustering algorithm. Privacy protection and reducing parameter sensitivity are important ways to improve the effect of abnormal data detection.

[0006] Therefore, how to provide an abnormal data detection method based on improved differential privacy and clustering algorithm optimization is a problem that technical personnel in this field urgently need to solve. Summary of the invention

[0007] One object of the present invention is to propose an abnormal data detection method based on improved differential privacy and clustering algorithm optimization. The present invention solves the problems of uneven data distribution and privacy information leakage by combining differential privacy protection mechanism, weighted sampling technology and multi-decision tree integration model, while protecting data privacy, improving the accuracy and robustness of abnormal data detection.

[0008] According to an embodiment of the present invention, the abnormal data detection method based on improved differential privacy and clustering algorithm optimization includes the following steps:

[0009] S1. Obtain a multi-dimensional data set to be processed, standardize the parameters of the data points, and generate a standardized data set;

[0010] S2. For the data points in the normalized data set, the Euclidean distance between the data points is calculated based on the OPTICS clustering algorithm, the distance information is denoised using the differential privacy algorithm, and the privacy budget parameters are optimized using the alpha-beta pruning algorithm to generate optimized privacy distance data.

[0011] S3. According to the optimized privacy distance data, determine the core objects and construct a core object set, and classify the density-connected data points into preliminary clusters through the density analysis algorithm;

[0012] S4, optimize the preliminary clusters, redistribute the sparse data points in combination with the recommendation domain mechanism, classify the sparse points into the most adjacent high-density clusters, and generate optimized clustering results;

[0013] S5. Based on the optimized clustering results, the improved random forest algorithm is used for classification. The uneven data distribution problem is balanced through the weighted sampling mechanism to generate the final classification results and output the abnormal data detection results.

[0014] Optionally, the S2 specifically includes:

[0015] S21. For the normalized data points, the relationship between the data points is calculated based on the Euclidean distance:

[0016]

[0017] Among them, d(x i ,x j ) is the data point distance, x i and x j are data points, m is the number of dimensions of the data point, x i,k and x j,k is the value of the data point in the kth dimension;

[0018] S22, wherein the Euclidean distance information is noised by a differential privacy algorithm to generate noised distance data:

[0019] d ′ (x i ,x j )=d(x i ,x j )+Lap(Δf / ∈);

[0020] Where: d ′ (x i ,x j ) is the distance after adding noise, d(x i ,x j ) is the original distance, Lap(Δf / ∈) is the Laplace noise, Δf is the sensitivity, and ∈ is the privacy budget;

[0021] S23. Use evaluation functions to balance privacy and data availability:

[0022] F[P(∈),Q(∈)]=α·P(∈)+β·Q(∈);

[0023] Among them, F is the evaluation function, P(∈) is the data privacy leakage function, its weight parameter is α, Q(∈) is the data availability function, its weight parameter is β;

[0024] S24. Optimize the privacy budget parameters through the alpha-beta pruning algorithm, and generate the final privacy distance data based on the optimized privacy budget parameters for the core object determination of the clustering algorithm:

[0025] ∈'=argmax{minF[P(∈),Q(∈)]};

[0026] Among them, ∈' is the new privacy budget.

[0027] Optionally, the S3 specifically includes:

[0028] S31, extract all data points from the data set, set an initial state for each data point, mark it as unprocessed, and use the optimized privacy distance data to calculate the neighborhood range of each data point;

[0029] S32, by traversing the data set, determining the core object according to the number of data points in the neighborhood, and adding it to the core object set;

[0030] S33, the core object set is composed of the determined core objects and the data points connected with them by density, and the association between the core objects and other data points is established through the neighborhood range and the direct density reachability relationship;

[0031] S34, the core object set is processed by a density analysis algorithm to group density-connected data points within the core object and its neighborhood;

[0032] S35. Perform preliminary density clustering on the data in the core object set.

[0033] Optionally, the S4 specifically includes:

[0034] S41, process the core object and generate an ordered queue. If the ordered queue is empty, return to step S3 and select a new core object for processing;

[0035] S42, if the ordered queue is not empty, take the first sample point from the ordered queue as the current processing object. If the point is not a core object, return to step S3 and continue to process the next data point. If the point is a core object, calculate its reachable distance and store the point with the smallest reachable distance in the result queue.

[0036] S43, all directly density reachable points within the neighborhood of the current core object are judged and updated. If the directly density reachable point already exists in the result queue, the processing is skipped; if the directly density reachable point exists in the ordered queue, the new reachable distance is compared with the original reachable distance; if the new distance is smaller, the distance value is updated and re-sorted; if the directly density reachable point is neither in the result queue nor in the ordered queue, it is inserted into the end of the queue;

[0037] S44, updating the recommended domain information, and reallocating the sparse data points in combination with the recommended domain mechanism;

[0038] S45, reordering the ordered queue, and adjusting the queue structure according to the density of the clusters in the recommendation domain and the reachable distance priority of the data points;

[0039] S46, repeat the above steps until all the core objects and the data points in their neighborhoods are processed, and an optimized clustering result is generated.

[0040] Optionally, the S5 specifically includes:

[0041] S51, taking the optimized clustering result as input data, extracting the classification information of the core objects, directly density-reachable objects and sparse data points in the clustering cluster;

[0042] S52. Based on the optimized clustering results, a classification model is constructed using an improved random forest algorithm, and the training data is trained using an integrated method of multiple decision trees;

[0043] S53, optimizing the category distribution of training data through a weighted sampling mechanism;

[0044] S54, the classification model predicts the input data points, generates the final classification results based on the voting results of multiple decision trees, and clarifies the labels of abnormal data points;

[0045] S55. Output the abnormal data detection results, including the labeling information of the abnormal data points, the classification statistics of the clusters, and the performance evaluation index of the classification model.

[0046] The beneficial effects of the present invention are:

[0047] The present invention ensures the protection of data privacy while achieving efficient abnormal data detection by introducing differential privacy algorithms and optimized clustering and classification techniques. In the data processing process, the differential privacy mechanism is used to add noise to sensitive information, which significantly reduces the risk of data leakage. The privacy budget parameters are optimized by the alpha-beta pruning method, achieving a dynamic balance between privacy protection and data availability, which effectively improves the calculation efficiency of the results and retains the analytical value of the data, providing a solid foundation for data mining and analysis.

[0048] In the cluster analysis stage, the present invention adopts the OPTICS clustering algorithm, combined with the optimized privacy distance data, to reduce the sensitivity of the algorithm to the input parameters. The recommended domain mechanism effectively improves the classification problem of sparse data points, and optimizes the density distribution of clusters, making the preliminary clustering results more stable and accurate. In addition, by updating the ordered queue and redistributing the sparse data points, the present invention further optimizes the cluster structure and significantly enhances the ability to handle sparse data and density changes.

[0049] In the classification stage, the present invention combines the improved random forest algorithm and weighted sampling mechanism to effectively solve the problem of uneven data distribution. Through the integrated voting mechanism of multiple decision trees, the generalization ability and robustness of the classification model are improved, and the detection ability of low-proportion categories is also significantly enhanced. The final generated abnormal data detection results are output in a structured form, including statistical information of each cluster, labels of abnormal points, and performance evaluation indicators of the classification model, providing users with efficient and reliable analysis basis. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0051] Figure 1 A flowchart of the abnormal data detection method based on improved differential privacy and clustering algorithm optimization proposed by the present invention;

[0052] Figure 2 This is a schematic diagram of the processing of differential privacy protection and alpha-beta pruning optimization of privacy budget for the abnormal data detection method based on improved differential privacy and clustering algorithm optimization proposed in the present invention. DETAILED DESCRIPTION

[0053] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, which only illustrate the basic structure of the present invention in a schematic manner, and therefore only show the components related to the present invention.

[0054] refer to Figure 1-2 ,The abnormal data detection method based on improved differential privacy and clustering algorithm optimization includes the following steps:

[0055] S1. Obtain a multi-dimensional data set to be processed, standardize the parameters of the data points, and generate a standardized data set;

[0056] S2. For the data points in the normalized data set, the Euclidean distance between the data points is calculated based on the OPTICS clustering algorithm, the distance information is denoised using the differential privacy algorithm, and the privacy budget parameters are optimized using the alpha-beta pruning algorithm to generate optimized privacy distance data.

[0057] S3. According to the optimized privacy distance data, determine the core objects and construct a core object set, and classify the density-connected data points into preliminary clusters through the density analysis algorithm;

[0058] S4, optimize the preliminary clusters, redistribute the sparse data points in combination with the recommendation domain mechanism, classify the sparse points into the most adjacent high-density clusters, and generate optimized clustering results;

[0059] S5. Based on the optimized clustering results, the improved random forest algorithm is used for classification. The uneven data distribution problem is balanced through the weighted sampling mechanism to generate the final classification results and output the abnormal data detection results.

[0060] In this implementation, S2 specifically includes:

[0061] S21. For the normalized data points, the relationship between the data points is calculated based on the Euclidean distance:

[0062]

[0063] Among them, d(x i ,x j ) is the data point distance, x i and x j are data points, m is the number of dimensions of the data point, x i,k and x j,k is the value of the data point in the kth dimension;

[0064] S22, wherein the Euclidean distance information is noised by a differential privacy algorithm to generate noised distance data:

[0065] d ′ (x i ,x j )=d(x i ,x j )+Lap(Δf / ∈);

[0066] Where: d ′ (x i ,x j ) is the distance after adding noise, d(x i ,x j ) is the original distance, Lap(Δf / ∈) is the Laplace noise, Δf is the sensitivity, and ∈ is the privacy budget;

[0067] S23. Use evaluation functions to balance privacy and data availability:

[0068] F[P(∈),Q(∈)]=α·P(∈)+β·Q(∈);

[0069] Among them, F is the evaluation function, P(∈) is the data privacy leakage function, its weight parameter is α, Q(∈) is the data availability function, its weight parameter is β;

[0070] S24. Optimize the privacy budget parameters through the alpha-beta pruning algorithm, and generate the final privacy distance data based on the optimized privacy budget parameters for the core object determination of the clustering algorithm:

[0071] ∈'=argmax{minF[P(∈),Q(∈)]};

[0072] Among them, ∈' is the new privacy budget.

[0073] In this implementation, S3 specifically includes:

[0074] S31, extract all data points from the data set, set an initial state for each data point, mark it as unprocessed, and use the optimized privacy distance data to calculate the neighborhood range of each data point;

[0075] S32, by traversing the data set, determining the core object according to the number of data points in the neighborhood, and adding it to the core object set;

[0076] S33, the core object set is composed of the determined core objects and the data points connected with them by density, and the association between the core objects and other data points is established through the neighborhood range and the direct density reachability relationship;

[0077] S34, the core object set is processed by a density analysis algorithm to group density-connected data points within the core object and its neighborhood;

[0078] S35. Perform preliminary density clustering on the data in the core object set.

[0079] In this implementation manner, the S4 specifically includes:

[0080] S41, process the core object and generate an ordered queue. If the ordered queue is empty, return to step S3 and select a new core object for processing;

[0081] S42, if the ordered queue is not empty, take the first sample point from the ordered queue as the current processing object. If the point is not a core object, return to step S3 and continue to process the next data point. If the point is a core object, calculate its reachable distance and store the point with the smallest reachable distance in the result queue.

[0082] S43, all directly density reachable points within the neighborhood of the current core object are judged and updated. If the directly density reachable point already exists in the result queue, the processing is skipped; if the directly density reachable point exists in the ordered queue, the new reachable distance is compared with the original reachable distance; if the new distance is smaller, the distance value is updated and re-sorted; if the directly density reachable point is neither in the result queue nor in the ordered queue, it is inserted into the end of the queue;

[0083] S44, updating the recommended domain information, and reallocating the sparse data points in combination with the recommended domain mechanism;

[0084] S45, reordering the ordered queue, and adjusting the queue structure according to the density of the clusters in the recommendation domain and the reachable distance priority of the data points;

[0085] S46, repeat the above steps until all the core objects and the data points in their neighborhoods are processed, and an optimized clustering result is generated.

[0086] In this implementation manner, S5 specifically includes:

[0087] S51, taking the optimized clustering result as input data, extracting the classification information of the core objects, directly density-reachable objects and sparse data points in the clustering cluster;

[0088] S52. Based on the optimized clustering results, a classification model is constructed using an improved random forest algorithm, and the training data is trained using an integrated method of multiple decision trees;

[0089] S53, optimizing the category distribution of training data through a weighted sampling mechanism;

[0090] S54, the classification model predicts the input data points, generates the final classification results based on the voting results of multiple decision trees, and clarifies the labels of abnormal data points;

[0091] S55. Output the abnormal data detection results, including the labeling information of the abnormal data points, the classification statistics of the clusters, and the performance evaluation index of the classification model.

[0092] Embodiment 1:

[0093] In order to verify the feasibility of the present invention in implementation, the present invention is applied to a certain e-commerce platform. The e-commerce platform generates more than 5 million order data every day, including multi-dimensional attributes such as user information, product information, order amount, transaction time, etc. The platform hopes to accurately identify orders that may contain fraudulent behavior while protecting user privacy through the method of the present invention. To this end, the daily order data is input into the abnormal data detection system of the present invention. First, the order data is standardized, and all numerical fields such as order amount and product quantity are uniformly mapped to the range of 0 to 1 to eliminate dimensional differences.

[0094] After data standardization, the OPTICS clustering algorithm is used to calculate the Euclidean distance between order data. In order to protect user privacy, the differential privacy method is introduced in the distance calculation process to add noise to the distance information of each order. At the same time, the alpha-beta pruning algorithm is used to optimize the privacy budget to ensure a balance between privacy protection and data availability. At this stage, the differential privacy algorithm effectively hides user sensitive information, such as the pattern of high-frequency purchase behavior or the abnormality of certain large orders, to avoid possible privacy leaks.

[0095] After completing the distance calculation, the optimized privacy distance is used to generate preliminary clustering results. The clustering results show multiple normal order clusters and some sparse potential abnormal orders. Combined with the recommendation domain mechanism, the sparse orders are optimized and classified, and some sparse points close to the normal order pattern are classified into the corresponding high-density clusters. For sparse points that cannot be classified, they are marked as abnormal orders.

[0096] Subsequently, based on the optimized clustering results, the improved random forest algorithm was applied to classify the order data. The problem of low proportion of abnormal orders was solved through the weighted sampling mechanism. In the data training phase, the sampling weights of a small number of abnormal orders were increased to ensure that the model could fully learn the characteristics of abnormal orders. Through the integration of 100 decision trees, a classification model was finally generated to predict all order data and mark potential fraudulent orders for a 30-day test.

[0097] Table 1 Daily order data processing and testing statistics

[0098]

[0099]

[0100] Table 2 Comparison of detection effects of different algorithms

[0101]

[0102] As can be seen from Table 1, in actual operation, the present invention can efficiently process about 5 million order data per day, and the total time for preliminary clustering and classification is controlled within about 2 hours. Among them, the preliminary clustering stage takes about 70 minutes, and the classification stage takes about 50 minutes, which greatly improves the efficiency compared with traditional methods. The number of potential abnormal orders detected every day is about 12,000, of which about 10,000 orders are confirmed as fraudulent orders after manual verification, and the accuracy rate is stable between 82.8% and 83.9%. This shows that the present invention has good stability and accuracy in large-scale data processing scenarios. In addition, as the amount of order data fluctuates, the detection time also maintains a small floating range, further illustrating the robustness and efficiency of the algorithm.

[0103] Table 2 shows the performance comparison between the present invention and the traditional method (DBSCAN combined with random forest). In terms of detection time, the present invention is significantly better than the traditional method, shortening the average time from 190 minutes to 120 minutes, a reduction of about 36.8%. In terms of accuracy, the present invention reaches 83.3%, which is 6.8 percentage points higher than the traditional method, and the detection of abnormal data is more accurate. In terms of recall rate, the present invention has also been improved to a certain extent, from 65.2% to 70.4%, better covering potential abnormal orders. At the same time, thanks to the introduction of the differential privacy algorithm, the present invention effectively reduces the risk of user privacy leakage, while the traditional method has great hidden dangers in high-frequency order processing and the protection of sensitive data. In summary, it is shown that the present invention has significant advantages in detection efficiency, accuracy and privacy protection.

[0104] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. An abnormal data detection method based on improved differential privacy and clustering algorithm optimization, characterized in that: The steps include: S1. Obtain a multi-dimensional data set to be processed, standardize the parameters of the data points, and generate a standardized data set; S2. For the data points in the normalized data set, the Euclidean distance between the data points is calculated based on the OPTICS clustering algorithm, the distance information is denoised using the differential privacy algorithm, and the privacy budget parameters are optimized using the alpha-beta pruning algorithm to generate optimized privacy distance data; S3. According to the optimized privacy distance data, determine the core objects and construct a core object set, and classify the density-connected data points into preliminary clusters through the density analysis algorithm; S4, optimize the preliminary clusters, redistribute the sparse data points in combination with the recommendation domain mechanism, classify the sparse points into the most adjacent high-density clusters, and generate optimized clustering results; S5. Based on the optimized clustering results, the improved random forest algorithm is used for classification. The uneven data distribution problem is balanced through the weighted sampling mechanism to generate the final classification results and output the abnormal data detection results.

2. The abnormal data detection method based on improved differential privacy and clustering algorithm optimization according to claim 1, characterized in that: The S2 specifically includes: S21. For the normalized data points, the relationship between the data points is calculated based on the Euclidean distance: Among them, d(x i ,x j ) is the data point distance, x i and x j are data points, m is the number of dimensions of the data point, x i,k and x j,k is the value of the data point in the kth dimension; S22, wherein the Euclidean distance information is noised by a differential privacy algorithm to generate noised distance data: d ′ (x i ,x j )=d(x i ,x j )+Lap(Δf / ∈); Where: d ′ (x i ,x j ) is the distance after adding noise, d(x i ,x j ) is the original distance, Lap(Δf / ∈) is the Laplace noise, Δf is the sensitivity, and ∈ is the privacy budget; S23. Use evaluation functions to balance privacy and data availability: F[P(∈),Q(∈)]=α·P(∈)+β·Q(∈); Among them, F is the evaluation function, P(∈) is the data privacy leakage function, its weight parameter is α, Q(∈) is the data availability function, its weight parameter is β; S24. Optimize the privacy budget parameters through the alpha-beta pruning algorithm, and generate the final privacy distance data based on the optimized privacy budget parameters for the core object determination of the clustering algorithm: ∈'=argmax{minF[P(∈),Q(∈)]}; Among them, ∈' is the new privacy budget.

3. The abnormal data detection method based on improved differential privacy and clustering algorithm optimization according to claim 1, characterized in that: The S3 specifically includes: S31, extract all data points from the data set, set an initial state for each data point, mark it as unprocessed, and use the optimized privacy distance data to calculate the neighborhood range of each data point; S32, by traversing the data set, determining the core object according to the number of data points in the neighborhood, and adding it to the core object set; S33, the core object set is composed of the determined core objects and the data points connected with them by density, and the association between the core objects and other data points is established through the neighborhood range and the direct density reachability relationship; S34, the core object set is processed by a density analysis algorithm to group density-connected data points within the core object and its neighborhood; S35. Perform preliminary density clustering on the data in the core object set.

4. The abnormal data detection method based on improved differential privacy and clustering algorithm optimization according to claim 1, characterized in that: The S4 specifically includes: S41, process the core object and generate an ordered queue. If the ordered queue is empty, return to step S3 and select a new core object for processing; S42, if the ordered queue is not empty, take the first sample point from the ordered queue as the current processing object. If the point is not a core object, return to step S3 and continue to process the next data point. If the point is a core object, calculate its reachable distance and store the point with the smallest reachable distance in the result queue. S43, all directly density reachable points within the neighborhood of the current core object are judged and updated. If the directly density reachable point already exists in the result queue, the processing is skipped; if the directly density reachable point exists in the ordered queue, the new reachable distance is compared with the original reachable distance; if the new distance is smaller, the distance value is updated and re-sorted; if the directly density reachable point is neither in the result queue nor in the ordered queue, it is inserted into the end of the queue; S44, updating the recommended domain information, and reallocating the sparse data points in combination with the recommended domain mechanism; S45, reordering the ordered queue, and adjusting the queue structure according to the density of the clusters in the recommendation domain and the reachable distance priority of the data points; S46, repeat the above steps until all the core objects and the data points in their neighborhoods are processed, and an optimized clustering result is generated.

5. The abnormal data detection method based on improved differential privacy and clustering algorithm optimization according to claim 1, characterized in that: The S5 specifically includes: S51, taking the optimized clustering result as input data, extracting the classification information of the core objects, directly density-reachable objects and sparse data points in the clustering cluster; S52. Based on the optimized clustering results, a classification model is constructed using an improved random forest algorithm, and the training data is trained using an integrated method of multiple decision trees; S53, optimizing the category distribution of training data through a weighted sampling mechanism; S54, the classification model predicts the input data points, generates the final classification results based on the voting results of multiple decision trees, and clarifies the labels of abnormal data points; S55. Output the abnormal data detection results, including the labeling information of the abnormal data points, the classification statistics of the clusters, and the performance evaluation index of the classification model.

Images